How to remember SSH password for one session

Question

Consider following scenario:

I am logged on serverA as a user 'common'. The key thing about common user is that a bunch of people have access to it - it is unrestricted and unsecure by design.

Let's say, I periodically need to login from this user/server to serverB as user secure - i.e. I need to scp files owned by secure@serverB.

While I have full access and control over secure user, I certainly do not want to add common's public key to trusted keys for secure user - I do not want anyone who can login as common to be able to login as secure as well.

I also do not want to type in secure's password 5 times per hour. Ideally, I'd like to type it once, have some agent or so magically remember it - but only for this login session - and than use it anytime I connect from this session until the timeout expires. Not unlike kinit, actually.

Is there anything out there which could achieve this goal?

Answer 1

It's not as easy if You have shared user on intermediate server and that user has shell access as almost everything there is by default accessible by each other session.
There are ways in modern kernels, of course.
Eigther there could be a tool that utilizes session (process/thread) keyrings to store the private data in kernel or the system can be probably be made safe enough to disallow the different processes of same user to access each other so a program could held the authentication information also in normal userspace memory protected from other sessions. Anyway both had to identify requests to do the authetication based on some PID/SID information which will work for basic usage. At the end You need a daemon that does the session setup for You or deliver the stored passwords to Your process so that You can use it with sshpass tool or such.

Another approach is to utilize namespaces and mount a private tmpfs or tmpdir (while tmpfs is better protected or at least less easy accessible from root users than tmpdir).

You could eigther use sshd on a separate port with a wrapper that sets up the namespace environment for that user, or most easily on a modern system at least You can use pam and pam_namespace.so to set up a private user tmpdir or tmpfs. There You could store eigther Your passworrd in cleartext to be used by sshpass or such or even better could put the socket for ssh-agent in that directory and load Your personal private key into that agent while ensuring the access to agent is protected from access by other sessions of same user. If You have a private key with stong password You can also store it on the machine. Otherwise You had to transfer it. You could also make the whole /tmp directory such a private dir (possibly with some subdirs shared) and utilize SSH agent forwarding in quite a secure manner (You can not really protect it to be abused by root user but at least if You use tmpfs it is dificult for root and not possible for normal user to use the Auth-Sock).

Anyway the You need to be able to configure the server sufficently or it needs to be configured sufficently - at least that far that the processes of the users cannot attach to each other.

Answer 2

You're probably looking for ssh-agent, which comes with OpenSSH. Use the -t option to set a timeout.